fix(gates): one settings home, four dangling $refs, two mistyped spec anchors, three tracked build artefacts

[rubenvdlinde]

Four gates, thirteen findings, all real. Measured with hydra-gates 48c88ba1e0d049f8f38538c33e790d3e603c55d0 against origin/development (3a542f28).

gate	before	after
gate-29 gitignore-then-commit	4	PASS
gate-46 spec-anchor-existence	4	PASS
gate-51 schema-property-titles	2	PASS
gate-54 relation-dialect	5	1
gate-63 settings-surface	2 + 1 WARN	PASS

Full-repo: 13 → 10 gates failing. Diff-scoped vs the root commit: 17 → 11.

---

gate-63 — the app had two settings homes and the nav said Settings > Settings

lib/Settings/SoftwareCatalogAdmin.php is registered in appinfo/info.xml and renders SoftwareCatalogSettings.vue via src/settings.js. The manifest also declared a type: "settings" page rendering the same component, and menu-layout.json lifted its menu entry into the gear foldout — whose button CnAppNav also labels Settings.

Per ADR-079 D1/D4 the in-app page and its menu entry are removed. /settings/admin/softwarecatalog is the one home, and it is the one Nextcloud authorizes server-side before the section renders; the in-app copy was authorized only by whatever the SPA remembered to check. Getting there is CnAppNav's admin-gated Admin settings link out — data-testid=cn-nav-admin-settings, verified present in the pinned @conduction/nextcloud-vue dist.

The three e2e tests were retargeted, not deleted

tests/e2e/manifest-pages.spec.ts drove #/settings in three tests. They now drive /settings/admin/softwarecatalog and assert the same three things about the same component. Deleting them would have removed the only proof this surface still renders — and would have quietly dropped three @e2e references that gate-19 counts.

gate-54 — four $refs that cannot resolve

element.properties, view.properties, model.properties and relation.properties all declare $ref: "#/components/schemas/property". There is no property schema in the register — the slug is property-definition. Four dangling nested-object references.

One finding left RED, deliberately

contract.decisions declares $ref: "Decision" with x-external-register: "decidesk" — a cross-register reference to a decidesk object, which is what ADR-066 asks for. gate-54 resolves $ref against "a schema key in the same register file set" and has no notion of an external register, so a correctly-authored cross-register relation can never pass it. Renaming or removing that $ref to make the gate green would break the ADR-066 relation to satisfy a checker. Left red; this is a gate gap, not an app defect.

gate-46 — fix the target, not the tag

• #requirement-modulversie-... (×2) — a typo. #requirement-moduleversie-records-sbom-import-provenance exists.
• suiteWizard.js::mapApplicationOptions named a requirement that does not exist. The scenario that actually governs it — "The applications step only offers modules that already exist" — sits under "The wizard SHALL guide suite creation…", so the tag now names its real parent.
• SbomParserService::parseSpdx() pointed at #notes, which did not exist. SPDX 2.x parsing is live (SbomImportService:226) and unit-tested but has no requirement at all. The spec gains a ## Notes section describing the second entry point — and says plainly that promoting it to a Requirement means writing the Scenarios and the Playwright test that assert them. A Notes section carries no Scenario, so this does not smuggle an unproven scenario past gate-19.

gate-51 — two properties with a title and no description

sbomComponent.hashes[].alg and .value.

⚠️ The 148 title == key occurrences in this register are VNG-standardised element names and are deliberately not touched — renaming a VNG standard element is a conformance break, not a fix.

gate-29 — three tracked files behind ignore rules

• .phpunit.cache/test-results, .phpunit.result.cache — PHPUnit build artefacts, correctly ignored and wrongly tracked. git rm --cached.
• data/GEMMA release.xml — a 13 MB AMEF fixture that test-setup.sh actually reads, sitting inside the ignored /data/ runtime directory. Deleting it would have broken AMEF seeding; a ! negation would not have helped (gate-29 strips ! before matching). It moves to tests/fixtures/amef/, where fixtures live, and test-setup.sh follows it.

---

Can-fail proof

Reverting the six changed source files to origin/development and re-running the suite puts every count back exactly:

[gate-46] spec-anchor-existence:   FAIL — 4
[gate-51] schema-property-titles:  FAIL — 2
[gate-54] relation-dialect:        FAIL — 5
[gate-63] settings-surface:        FAIL — 2

Other measurements

• check:manifest — Ajv validation PASS (0 errors), 29 pages, schema 2.19.0.
• vitest — 215/215 across 19 files.
• tsc --noEmit on the changed e2e spec — clean.
• All three touched JSON documents parse.
• No other gate count moved.

[github-actions]

Quality Report — ConductionNL/softwarecatalog @ 2d748be

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
composer			✅	✅ 128/128
npm			✅	✅ 718/718
PHPUnit					✅
Newman					⏭️
Playwright					❌
Hydra gates					❌

---

Quality workflow — 2026-08-09 14:47 UTC

Download the full PDF report from the workflow artifacts.

[github-actions]

Quality Report — ConductionNL/softwarecatalog @ 8a817e9

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
check-vue-demi		✅
test-l10n		✅
composer			✅	✅ 128/128
npm			✅	✅ 718/718
PHPUnit					✅
Newman					⏭️
Playwright					✅
Hydra gates					❌

---

Quality workflow — 2026-08-09 15:32 UTC

Download the full PDF report from the workflow artifacts.